SpyFone, a mobile stalkerware application operated by Puerto Rico-based Support King, LLC, suffered a data breach in August 2018 when a security researcher discovered that SpyFone had left several terabytes of data harvested from more than 3,600 monitored devices publicly accessible via a misconfigured Amazon Web Services S3 storage bucket. The exposed data was the surveillance content collected from devices on which SpyFone customers had installed the application. The same researcher discovered that SpyFone's backend services could be accessed without credentials and that arbitrary administrative accounts could be created against the customer database. The breach was indexed by Have I Been Pwned on August 24, 2018.

The breach affected approximately 44,100 unique customer email addresses based on records indexed by Have I Been Pwned, and approximately 2,200 individuals whose personal information was accessed by the attacker according to the FTC's subsequent investigation. Compromised customer fields included email addresses, names, IP addresses, geographic locations, browsing histories, IMEI device identifiers, and passwords stored in plaintext. Critically, the breach also exposed the surveillance content captured from the monitored target devices including photos, audio recordings, text messages, browsing histories, and GPS location data covering thousands of individuals who were being secretly monitored without their knowledge. SpyFone publicly promised to investigate the breach with an outside data security firm and law enforcement, but the FTC's subsequent investigation concluded that SpyFone failed to follow through on those promises.

For surveillance targets and customers alike, the practical risk profile is exceptionally severe and varies between the two populations. For surveillance targets (the people whose devices were being secretly monitored), the breach exposed live and historical device data that may have been collected without their knowledge or consent, with the U.S. National Domestic Violence Hotline (1-800-799-7233) and the Coalition Against Stalkerware providing resources for individuals who suspect they may have been monitored. Affected device owners may have received an FTC-mandated notification from Support King under the 2021 consent order alerting them that their devices were monitored and may not be secure. For customers (the people who purchased SpyFone to surveil others), the breach exposed their identification as someone who purchased and used surveillance software, with potential employment, relationship, and legal consequences depending on the jurisdiction and the consent status of the surveillance target. Customers should change all reused passwords on other accounts because the plaintext password exposure means any account where the same password was reused is fully compromised. The U.S. Wiretap Act and the Computer Fraud and Abuse Act may apply to customers whose use of SpyFone constituted unauthorized surveillance of devices they did not own or were not authorized to monitor.

Mobile spyware platforms collect customer records, target-device identifiers, monitoring settings, and exfiltrated activity data tied to covert surveillance workflows.

SpyFone is now defunct. Following the 2018 breach, the U.S. Federal Trade Commission brought an enforcement action against Support King, LLC and CEO Scott Zuckerman, resulting in a final consent order on September 1, 2021 that became the first FTC ban of a stalkerware company from the surveillance industry (after the agency's 2019 Retina-X enforcement action which banned the sale of three specific Retina-X applications without imposing a full surveillance-business ban). The FTC order required Support King and Zuckerman to delete all illegally collected data, notify affected device owners, and permanently exit the surveillance industry. In 2025, the FTC denied a petition to vacate or modify the 2021 order. The case has been formally cited in Coalition Against Stalkerware advocacy commentary and in subsequent FTC stalkerware enforcement actions as setting the precedent for full surveillance-industry bans rather than product-specific restrictions.